// +optional
  optional k8s.io.api.core.v1.ObjectReference related = 9;

  // note is a human-readable description of the status of this operation.
  // Maximal length of the note is 1kB, but libraries should be prepared to
  // handle values up to 64kB.
  // +optional
  optional string note = 10;

  // type is the type of this event (Normal, Warning), new types could be added in the future.

  // User attributes of the user making this request.
  // +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;
}

// TokenReview attempts to authenticate a token to a known user.
// Note: TokenReview requests may be cached by the webhook token authenticator
// plugin in the kube-apiserver.
message TokenReview {
  // Standard object's metadata.

  // +optional
  optional k8s.io.api.core.v1.ObjectReference related = 9;

  // note is a human-readable description of the status of this operation.
  // Maximal length of the note is 1kB, but libraries should be prepared to
  // handle values up to 64kB.
  // +optional
  optional string note = 10;

  // type is the type of this event (Normal, Warning), new types could be added in the future.

// in addition to String() and AsInt64() accessors.
//
// The serialization format is:
//
// ```
// <quantity>        ::= <signedNumber><suffix>
//
// 	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
//
// <digit>           ::= 0 | 1 | ... | 9
// <digits>          ::= <digit> | <digit><digits>

  // +optional
  optional int64 expirationSeconds = 4;

  // BoundObjectRef is a reference to an object that the token will be bound to.
  // The token will only be valid for as long as the bound object exists.
  // NOTE: The API server's TokenReview endpoint will validate the
  // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
  // small if you want prompt revocation.
  // +optional